Eliminating Errors in Worm Propagation Models

Abstract

Research on worm propagation has been conducted for over a decade. However, traditional models overestimate the scale of the infected network that leads to propagation errors because of limited and inaccurate analysis of the propagation procedure between each pair of nodes in the network. This paper studies the propagation mechanism of the two main classes of worms: scanning worms (Code Red II) and nonreinfection email worms. We aim at eliminating overestimation in worm propagation modeling caused by errors. Through the analysis of the propagation procedure, we observe that the error is mainly caused by propagation cycles in the propagation path, which are usually ignored by traditional models. Our simulations and analysis show the fact that the existence of errors has non-negligible effect on worm propagation modeling. We quantify the error and propose a method to eliminate it.